Software Bill of Materials (SBOM)

Snackbox is released under the BSD-3-Clause License. All direct and transitive Go module dependencies use MIT, BSD-3-Clause, or Apache-2.0 - all of which are compatible with BSD-3-Clause outbound licensing and impose no copyleft or viral obligations.

Notable: mattn/go-sqlite3 bundles the SQLite C amalgamation, which is public domain and carries no license obligations.

How to Evaluate

Install go-licenses and run it from the repository root:

go install github.com/google/go-licenses@latest
$(go env GOPATH)/bin/go-licenses report ./...

This prints one line per dependency with its name, license URL, and SPDX identifier. Update the table below whenever go.mod changes. Also run make govulncheck to check all listed packages for known CVEs.

Dependencies